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REMARKS 

Reconsideration and allowance of the subject patent application are respectfully 
requested. 

Applicants acknowledge with appreciation the indication that claims 5 and 10 
contain allowable subject matter. 

Claims 1-4, 6-9, 1 1 and 12 were rejected under 35 U.S.C. Section 102(e) as 
allegedly being "anticipated" by Stolfo et al (U.S. Publication No. 2003/0167402). 
Applicant traverses this rejection. 

As noted in the prior response, claim 1 1 corresponds to original claim 5 written in 
independent form. In accordance with the indication in the 10/10/2007 and 2/28/2008 
office actions, this claim is beheved to be in condition for allowance. Applicant notes 
that the rejection of this claim in the office action does not address the specific limitations 
present in the last paragraph of this claim. 

Claim 1 recites: 

b) examining the executable attachment and comparinR the 
executable attachment with the extracted structural elements to determine 
whether the executable attachment contains code, data or encoded data that 
could have created the extracted structural elements (emphasis added). 

Claim 1 further recites that the attachment is signaled as being possibly viral or not on the 

basis of the extent to which the examining step b) finds evidence that the structural 

elements have been created by that attachment. 

Claims 6 and 12 recites similar features. 
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Claim 1 defines the processing of a single email. As the "extracted structural 
elements" are defined as being extracted fi'om that email, it is expressly recited that the 
comparison is between (1) an executable attachment attached to the email and (2) 
structural elements extracted fi'om the same email; that is the only email referred to in 
claim 1. Consequently, Applicant respectfiiUy submits that claim 1 already adequately 
reflects the intemal comparison referenced in the final sentence of paragraph 3 of the 
office action. 

Moreover, Applicant respectfully submits that the parts of Stolfo et al. relied upon 
in the office action do not fall within the scope of the "examining" feature of claim 1 
because they do not meet the recitation in claim 1 discussed above of "comparing the 
executable attachment with the extracted structural elements." 

Regarding feature (b) of claim 1, the discussion of Stolfo et al. relied upon in 
paragraphs 3 and 5 of the office action are paragraphs [0061] and [0019]-[0020]. 

Paragraph [0061] of Stolfo et al discloses comparing (1) statistics relating to an 
executable attachment with (2) a model. It is clear from claim 1 of Stolfo et al. and also 
paragraph [0018] that the model is derived from prior emails, i.e., not the "selected" 
email under consideration. 

Paragraphs [0019]-[0020] describe the statistics relating to an executable 
attachment. As is clear fi-om claims 6 and 7 of Stolfo et al., such statistics are an example 
of the "statistics relating to said transmission of selected email [i.e., the email under 
consideration]." The statistics relating to an executable attachment include statistics 
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relating to structural elements of the email (for example statistics relating to the 
destination or source address of an email containing the attachment). Applicant assumes 
for the sake of argument that this is viewed as extracting structural elements of an email 
under consideration as set forth in feature (a) of claim 1 . As mentioned above, 
paragraphs [0061] and [0019]-[0020] of Stolfo et al relied upon in the office action 
disclose comparison of (1) statistics relating to such structural elements and associated 
with an executable attachment with (2) a model. However, there is no disclosure of 
feature (b) of claim 1 which requires comparison (1) of an executable attachment 
attached to the email with (2) structural elements extracted from the same email, as 
discussed above. 

In suromary, even if Stolfo et al. can be said to use structural elements of emails 
containing an attachment in comparison, the comparison does not in any way meet the 
definition in claim 1 of "comparing the executable attachment with the extracted 
structural elements", because the comparison is with a model. 

The fifth sentence of paragraph 3 of the office action alleges that paragraph [0020] 
of Stolfo et al. discloses "a comparison of the recorded structural elements to a particular 
element." Applicant respectfiilly submits that this is not what paragraph [0020] discloses. 

Paragraph [0020] of Stolfo et al. firstly discloses gathering statistics related to an 
attachment, which statistics may include the number of addresses to which the attachment 
is transmitted (destination addresses) or which transmit the attachment (source 
addresses). Such gathering of statistics does not constitute "comparing the executable 
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attachment with the extracted structural elements." There is no comparison involved in 
counting the destination or source addresses of emails containing a particular attachment. 

Paragraph [0020] of Stolfo et al. secondly discloses comparison of the gathered 
statistics with a model, the model being disclosed in paragraph [0018] and claim 1 of 
Stolfo et al. as being derived from prior emails. This comparison does not constitute 
"comparing the executable attachment with the extracted structural elements." 

In this regard. Applicant notes that paragraphs 3 and 5 of the office action 
consistently refer to this feature as "examining the executable attachment and comparing 
the extracted structural elements to determine ..." This incorrectly reflects the language 
of claim 1 because the actual recitation in claim 1 is "examining the executable 
attachment and comparing the executable attachment with the extracted structural 
elements to determine ..." Thus, the office action omits the words "executable 
attachment with". This is important because although the office action characterizes 
Stolfo et al. as disclosing a comparison involving structural elements, the comparison in 
Stolfo et al. is with a model, not with the executable attachment as recited in claim 1 . 

New claim 14 depends from claim 12. Claim 14 is based on claim 5 and is 
believed to be allowable. 
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The pending claims are believed to patentably distinguish from the applied art and 
favorable office action is respectfully requested. 

Respectfully submitted, 



NIXON & VANDERHYE P.C. 




Micha^. Shea 
Reg. No. 34,725 
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901 North Glebe Road, 1 1th Floor 
Arlington, VA 22203-1808 
Telephone: (703)816-4000 
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